CVE-2024-21638

Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.

• CWE-269
• CWE-287

• https://github.com/Azure/ipam/commit/64ef2d07edf16ffa50f29c7e0e25d32d974b367fPatch
• https://github.com/Azure/ipam/pull/218Patch
• https://github.com/Azure/ipam/security/advisories/GHSA-m8mp-jq4c-g8j6Mitigation, Vendor Advisory
• https://github.com/Azure/ipam/commit/64ef2d07edf16ffa50f29c7e0e25d32d974b367fPatch
• https://github.com/Azure/ipam/pull/218Patch
• https://github.com/Azure/ipam/security/advisories/GHSA-m8mp-jq4c-g8j6Mitigation, Vendor Advisory

Published

Jan 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21632omniauth-microsoft_graph provides an Omniauth strategy for t…9.8
• CVE-2024-21633Apktool is a tool for reverse engineering Android APK files.…7.8
• CVE-2024-21634Amazon Ion is a Java implementation of the Ion data notation…7.5
• CVE-2024-21635Memos is a privacy-first, lightweight note-taking service th…7.5
• CVE-2024-21636view_component is a framework for building reusable, testabl…6.1
• CVE-2024-21637Authentik is an open-source Identity Provider. Authentik is …5.4
• CVE-2024-21639CEF (Chromium Embedded Framework ) is a simple framework for…9.6
• CVE-2024-21640Chromium Embedded Framework (CEF) is a simple framework for …9.6
• CVE-2024-21641Flarum is open source discussion platform software. Prior to…4.7
• CVE-2024-21642D-Tale is a visualizer for Pandas data structures. Users hos…7.5
• CVE-2024-21643IdentityModel Extensions for .NET provide assemblies for web…8.8
• CVE-2024-21644pyLoad is the free and open-source Download Manager written …7.5